Browse All CVEs
50,450 vulnerabilities.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-82214 |
medium | 5.3 | 0.0025 | 2026-10-31 | The Quick Event Manager WordPress plugin before 9.19 does not verify the status or type of | |
CVE-2026-118638 |
high | 7.5 | 0.0025 | 2026-10-31 | The Mapster WP Maps WordPress plugin before 2.0.6 does not perform any authorization check | |
CVE-2026-118629 |
medium | 5.3 | 0.0025 | 2026-10-31 | The All-in-One Video Gallery WordPress plugin before 5.0.0 does not check a video's publi | |
CVE-2026-118438 |
medium | 6.8 | 0.0029 | 2026-10-31 | The Firelight Lightbox WordPress plugin before 2.3.24 does not properly escape image attri | |
CVE-2026-118437 |
low | 3.7 | 0.0021 | 2026-10-31 | The BuddyForms WordPress plugin before 2.10.1 does not properly verify ownership before de | |
CVE-2026-118185 |
high | 7.5 | 0.0029 | 2026-10-31 | The Security Optimizer WordPress plugin before 1.6.9 does not limit the number of two-fac | |
CVE-2026-118184 |
medium | 5.3 | 0.0021 | 2026-10-31 | The Premium Packages WordPress plugin before 7.2.2 does not prevent unauthenticated visit | |
CVE-2026-118043 |
high | 7.2 | 0.0024 | 2026-10-31 | The Bulk Media Register WordPress plugin before 2.01 does not properly validate a user-sup | |
CVE-2026-110808 |
medium | 4.2 | 0.0023 | 2026-10-31 | The Essential Addons for Elementor WordPress plugin before 6.8.8 does not correctly restr | |
CVE-2026-110042 |
medium | 4.9 | 0.0029 | 2026-10-31 | The Payment Forms for Paystack WordPress plugin before 4.0.6 does not properly restrict ac | |
CVE-2026-92294 |
medium | 6.5 | 0.0044 | 2026-10-31 | The Spectra Gutenberg Blocks – Website Builder for the Block Editor plugin for WordPress i | |
CVE-2026-119977 |
high | 8.1 | 0.0120 | 2026-10-31 | KEV 1 PoC | WordPress WordPress Core contains a time-of-check time-of-use (TOCTOU) race condition vuln |
CVE-2026-116563 |
medium | 5.4 | 0.0035 | 2026-10-31 | The Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery plugin for WordPress is | |
CVE-2026-116520 |
high | 7.2 | 0.0038 | 2026-10-31 | The PPWP – Password Protect Pages plugin for WordPress is vulnerable to Stored Cross-Site | |
CVE-2026-109997 |
high | 7.2 | 0.0044 | 2026-10-31 | The Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Bui | |
CVE-2026-109234 |
high | 7.2 | 0.0038 | 2026-10-31 | The Meow Lightbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via th | |
CVE-2026-101326 |
medium | 5.4 | 0.0037 | 2026-10-31 | The The Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form | |
CVE-2026-100155 |
medium | 6.5 | 0.0051 | 2026-10-31 | The The Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form | |
CVE-2025-5278 |
medium | 4.4 | 0.0031 | 2026-10-31 | A flaw was found in GNU Coreutils. The sort utility's begfield() function is vulnerable to | |
CVE-2026-101682 |
high | 7.8 | 0.0018 | 2026-10-31 | Vulnerability in the Applications DBA product of Oracle E-Business Suite (component: AD Ut | |
CVE-2026-116755 |
high | 7.4 | 0.0093 | 2026-10-31 | Improper Neutralization of Special Elements used in a Command ('Command Injection') in the | |
CVE-2026-110176 |
high | 8.7 | 0.0025 | 2026-10-31 | The File Force Download module for Drupal 7 implements hook_file_download() to add a Conte | |
CVE-2026-83958 |
medium | 5.4 | 0.0020 | 2026-10-31 | Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerabili | |
CVE-2026-83662 |
critical | 9.3 | 0.0103 | 2026-10-31 | Adobe Experience Manager is affected by a reflected Cross-Site Scripting (XSS) vulnerabili | |
CVE-2026-75732 |
critical | 9.9 | 0.0071 | 2026-10-31 | Adobe Experience Manager is affected by an Incorrect Authorization vulnerability that coul | |
CVE-2026-48398 |
medium | 5.4 | 0.0025 | 2026-10-31 | Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerabili | |
CVE-2026-48383 |
critical | 10.0 | 0.0097 | 2026-10-31 | Adobe Experience Manager is affected by an Incorrect Authorization vulnerability that coul | |
CVE-2026-77152 |
medium | 5.3 | 0.0023 | 2026-10-31 | Improper Authorization vulnerability in Drupal Field Collection for Drupal 7 allows a user | |
CVE-2026-117656 |
critical | 9.3 | 0.0023 | 2026-10-31 | Acceptance of Extraneous Untrusted Data With Trusted Data vulnerability in the Sign in wit | |
CVE-2026-110084 |
high | 7.1 | 0.0047 | 2026-10-31 | Adobe Experience Manager is affected by an XML Injection (aka Blind XPath Injection) vulne | |
CVE-2026-110083 |
high | 7.1 | 0.0034 | 2026-10-31 | Adobe Experience Manager is affected by an Improper Neutralization of Special Elements use | |
CVE-2026-110082 |
medium | 5.4 | 0.0036 | 2026-10-31 | Adobe Experience Manager is affected by a reflected Cross-Site Scripting (XSS) vulnerabili | |
CVE-2026-110081 |
medium | 5.4 | 0.0036 | 2026-10-31 | Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability | |
CVE-2026-93577 |
critical | 9.9 | 0.0063 | 2026-10-30 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19. | |
CVE-2026-89078 |
critical | 9.9 | 0.0052 | 2026-10-30 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19. | |
CVE-2026-14474 |
high | 8.8 | 0.0057 | 2026-10-30 | A flaw was found in SSSD's LDAP sudo provider. When the ldap_sudo_search_base option is no | |
CVE-2026-63339 |
high | 8.8 | 0.0027 | 2026-10-30 | IXP Manager is a full-stack web application for managing Internet Exchange Points. Prior t | |
CVE-2026-63402 |
medium | 5.9 | 0.0026 | 2026-10-30 | i18next is an internationalization framework for JavaScript. Prior to version 26.3.4, `dee | |
CVE-2026-63401 |
medium | 5.3 | 0.0027 | 2026-10-30 | Coop is an open source review and moderation tool from ROOST. Prior to 1.0.2, `addAccessib | |
CVE-2026-63399 |
medium | 6.9 | 0.0029 | 2026-10-30 | Coop is an open source review and moderation tool from ROOST. Prior to 1.0.0, the `GraphQL | |
CVE-2026-63396 |
high | 8.7 | 0.0031 | 2026-10-30 | Coop is an open source review and moderation tool from ROOST. Prior to 1.0.0, an unauthent | |
CVE-2026-63414 |
high | 7.6 | 0.0075 | 2026-10-30 | Shopify App is a Rails engine for building Shopify applications. From 22.1.0 until 23.0.3, | |
CVE-2026-63410 |
medium | 5.9 | 0.0028 | 2026-10-30 | secp256k1-native is a native C secp256k1 implementation for Ruby. In affected native build | |
CVE-2026-63400 |
low | 2.3 | 0.0027 | 2026-10-30 | Coop is an open source review and moderation tool from ROOST. Prior to 1.0.2, `resetPasswo | |
CVE-2026-63398 |
high | 7.4 | 0.0018 | 2026-10-30 | Coop is an open source review and moderation tool from ROOST. Prior to 1.0.2, the SAML str | |
CVE-2026-14476 |
high | 8.0 | 0.0067 | 2026-10-30 | A path traversal flaw was found in SSSD's AD GPO provider. The ad_gpo_extract_smb_componen | |
CVE-2026-63345 |
high | 8.6 | 0.0035 | 2026-10-30 | Refitter is a tool for generating a C# REST API client using the Refit library. Prior to 2 | |
CVE-2026-63341 |
high | 7.5 | 0.0037 | 2026-10-30 | Aedes is an MQTT broker that can run on any stream server. Prior to 1.1.1, the MQTT broker | |
CVE-2026-61725 |
medium | 6.1 | 0.0014 | 2026-10-30 | sevenz-rust2 is a Rust-native 7z compressor and `decompress`or. Prior to 0.21.1, extractin | |
CVE-2026-63378 |
high | 8.8 | 0.0036 | 2026-10-30 | TAKO AI Agent for Okta is a local-first AI agent that helps Okta administrators query tena |